Jobberbase 2.0 - Multiple Vulnerabilities

Jobberbase 2.0 - Multiple Vulnerabilities Jobberbase: http://www.jobberbase.com/ Version: 2.0 By Ross Marks: http://www.rossmarks.co.uk 1 Local path disclosure - change any variable to an array and in most cases it will tell you the local path where the application is installed eg...

SQL injection vulnerability in the id parameter of the page of the digital newspaper system /www/index.php?mod=admin&con=adminuser&act=mypwdpost

Joy Reading Kiosk Digital Newspaper System is a digital newspaper WEB management system. There are SQL injection vulnerabilities in this product, the vulnerability URL is: /www/index.php?mod=admin&con=adminuser&act=mypwdpost, the vulnerability parameter is: id, POST method of injection, the...

WordPress Email Users 4.8.3 Cross Site Request Forgery

------------------------------------------------------------------------ Cross-Site Request Forgery vulnerability in Email Users WordPress Plugin ------------------------------------------------------------------------ Julien Rentrop, July 2016...

WordPress Count per Day 3.5.4 Plugin - Persistent Cross-Site Scripting

Exploit for php platform in category web applications Stored Cross-Site Scripting vulnerability in Count per Day WordPress Plugin Abstract A Cross-Site Scripting vulnerability was found in the Count per Day WordPress Plugin. This issue can be exploited by an unauthenticated attacker and allows an...

The Han Code of College graduate employment system /admin/manager/admin_voting_show.php page_id parameter SQL injection

No description provided by source...

Getsimple CMS 3.3.10 Shell Upload

Exploit Title: Getsimple CMS 2. An attacker login to the admin page and uploading the backdoor 3. The uploaded file will be under the "/data/uploads/" folder Report Timeline ============...

WordPress Plugin Ultimate Product Catalog 3.8.1 - Privilege Escalation

/Functions/UpdateAdmin-Databases.php file. Remote attackers are able to request crafted data of the POST method request with the vulnerable ´accesrole´ parameter. The security risk of the privilege scalation web vulnerability is estimated as high with a cvss common vulnerability scoring system...

Nextcloud: https://newsletter.nextcloud.com Directory listening and Information Disclosure

Hi, This is the domain that we are going to work about it as you know: https://newsletter.nextcloud.com/ Firstly I want to tell https://newsletter.nextcloud.com/admin when you are trying to navigate this link it needs authentication.But when you are doing this with via IP...

Pornhub: (Pornhub & Youporn & Brazzers ANDROID APP) : Upload Malicious APK / Overrite Existing APK / Android BackOffice Access

The researcher discovered weak credentials protecting an Android APK admin page...

phpMyFAQ Cross-Site Request Forgery Vulnerability

phpMyFAQ is a multi-language, fully database-driven FAQ system. A cross-site request forgery vulnerability exists in phpMyFAQ. Due to the application failing to properly validate the 'Interface Translation' translation function of the originating HTTP request. An unauthenticated remote attacker c...

BlueCMS v1.6 sp1 /admin/tpl_manage.php 本地文件包含漏洞

No description provided by source...

FerretCMS 'admin.php' Cross-Site Scripting Vulnerability

FerretCMS is a content management system CMS based on PHP and MySQL. The system provides features such as page management, template management and user management. A cross-site scripting vulnerability exists in FerretCMS, which stems from the program's failure to adequately filter user-submitted...

CVE-2016-1324

The REST interface in Cisco Spark 2015-06 allows remote attackers to cause a denial of service resource outage by accessing an administrative page, aka Bug ID CSCuv84125...

SMEweb 1.5f Cross Site Scripting / SQL Injection

Exploit Title : SMEweb 1.5f Multiple Vulnerability Exploit Author : Persian Hack Team Vendor Homepage : http://www.ebizzi.net/ Google Dork : "Powered by SMEweb" Date: 2016/02/07 Version: 1.5f PoC: 1-Admin Page Bypass Username : '=''or' Password : '=''or' Demo :...

Dream Gallery 1.0 SQL Injection

Sql Injection on Dream Gallery v1.0 + Date: 10/01/2016 + Risk: High + CWE Number : CWE-89 + Author: Felipe Andrian Peixoto + Vendor Homepage: http://clareslab.com.br/ + Software Demo : http://clareslab.com.br/dream/ + Contact: [email protected] + Tested on: Windows 7 and Gnu/Linux + Dork:...

OpenSolution Quick.Cart 'admin.php' Cross-Site Scripting Vulnerability

OpenSolution Quick.Cart is a PHP-based open source e-commerce software from OpenSolution Poland. The software supports engine optimization , module extensions and so on. A cross-site scripting vulnerability exists in OpenSolution Quick.Cart version 6.6. An attacker can exploit the vulnerability t...

Welcart vulnerable to SQL injection

Overview Welcart provided by Collne Inc. is a WordPress plugin. Welcart contains an SQL injection vulnerability CWE-89 due to a flaw in the processing of searchcolumn and switch parameter in admin.php. Shoji Baba reported this vulnerability to IPA. JPCERT/CC coordinated with the developer under...

ThaiWebPlus CMS Cross Site Scripting Vulnerability

Exploit for php platform in category web applications Exploit Title : ThaiWebPlus CMS Cross Site Scripting Vulnerability Exploit Author : Persian Hack Team Vendor Homepage : http://thaiwebplus.com Google Dork : Powered by ThaiWebPlus inurl:idrun= Date : 2015/12/12 Version : 1.0 1-1:Admin Page msg...

Mail.ru: [babel.mail.ru] Admin Page Found

Access to babel.mail.ru admin page was not sufficiently filtered, allowing accounts bruteforcing. bable.mail.ru is not directly listed in the bug bounty scope, but this vulnerability could affect projects in the scope...

WordPress Users Ultra 1.5.50 Cross Site Scripting

Exploit Title: WordPress Users Ultra Plugin Persistence XSS Discovery Date: 2015/10/20 Public Disclosure Date: 2015/12/01 Exploit Author: Panagiotis Vagenas Contact: https://twitter.com/panVagenas Vendor Homepage: http://usersultra.com Software Link: https://wordpress.org/plugins/users-ultra/...